git.iko.soy/typeable/postgresql-simple
on 41cb306 help sign in
877 lines 32 kB history raw
1{-# LANGUAGE DeriveDataTypeable #-}
2{-# LANGUAGE NamedFieldPuns #-}
3{-# LANGUAGE OverloadedStrings #-}
4{-# LANGUAGE PatternGuards #-}
5{-# LANGUAGE RecordWildCards #-}
6{-# LANGUAGE ViewPatterns #-}
8------------------------------------------------------------------------------
9-- |
10-- Module: Database.PostgreSQL.Simple
11-- Copyright: (c) 2011 MailRank, Inc.
12-- (c) 2011-2012 Leon P Smith
13-- License: BSD3
14-- Maintainer: Leon P Smith <leon@melding-monads.com>
15-- Stability: experimental
16--
17-- A mid-level client library for the PostgreSQL database, aimed at ease of
18-- use and high performance.
19--
20------------------------------------------------------------------------------
22module Database.PostgreSQL.Simple
23 (
24 -- * Writing queries
25 -- $use
27 -- ** The Query type
28 -- $querytype
30 -- ** Parameter substitution
31 -- $subst
33 -- *** Type inference
34 -- $inference
36 -- ** Substituting a single parameter
37 -- $only_param
39 -- ** Representing a list of values
40 -- $in
42 -- ** Modifying multiple rows at once
43 -- $many
45 -- ** @RETURNING@: modifications that returns results
46 -- $returning
48 -- * Extracting results
49 -- $result
51 -- ** Handling null values
52 -- $null
54 -- ** Type conversions
55 -- $types
57 -- * Types
58 Base.ConnectInfo(..)
59 , Connection
60 , Query
61 , ToRow
62 , FromRow
63 , In(..)
64 , Binary(..)
65 , Only(..)
66 , (:.)(..)
67 -- ** Exceptions
68 , SqlError(..)
69 , PQ.ExecStatus(..)
70 , FormatError(fmtMessage, fmtQuery, fmtParams)
71 , QueryError(qeMessage, qeQuery)
72 , ResultError(errSQLType, errHaskellType, errMessage)
73 -- * Connection management
74 , Base.connect
75 , Base.connectPostgreSQL
76 , Base.postgreSQLConnectionString
77 , Base.defaultConnectInfo
78 , Base.close
79 -- * Queries that return results
80 , query
81 , query_
82 -- ** Queries taking parser as argument
83 , queryWith
84 , queryWith_
85 -- * Queries that stream results
86 , FoldOptions(..)
87 , FetchQuantity(..)
88 , defaultFoldOptions
89 , fold
90 , foldWithOptions
91 , fold_
92 , foldWithOptions_
93 , forEach
94 , forEach_
95 , returning
96 -- * Statements that do not return results
97 , execute
98 , execute_
99 , executeMany
100-- , Base.insertID
101 -- * Transaction handling
102 , withTransaction
103 , withSavepoint
104-- , Base.autocommit
105 , begin
106 , commit
107 , rollback
108 -- * Helper functions
109 , formatMany
110 , formatQuery
111 ) where
113import Blaze.ByteString.Builder
114 ( Builder, fromByteString, toByteString )
115import Blaze.ByteString.Builder.Char8 (fromChar)
116import Blaze.Text ( integral )
117import Control.Applicative ((<$>), pure)
118import Control.Exception as E
119import Control.Monad (foldM)
120import Data.ByteString (ByteString)
121import Data.Int (Int64)
122import Data.List (intersperse)
123import Data.Monoid (mconcat)
124import Data.Typeable (Typeable)
125import Database.PostgreSQL.Simple.Compat ( (<>) )
126import Database.PostgreSQL.Simple.FromField (ResultError(..))
127import Database.PostgreSQL.Simple.FromRow (FromRow(..))
128import Database.PostgreSQL.Simple.Ok
129import Database.PostgreSQL.Simple.ToField (Action(..), inQuotes)
130import Database.PostgreSQL.Simple.ToRow (ToRow(..))
131import Database.PostgreSQL.Simple.Types
132 ( Binary(..), In(..), Only(..), Query(..), (:.)(..) )
133import Database.PostgreSQL.Simple.Internal as Base
134import Database.PostgreSQL.Simple.Transaction
135import Database.PostgreSQL.Simple.TypeInfo
136import qualified Database.PostgreSQL.LibPQ as PQ
137import qualified Data.ByteString.Char8 as B
138import qualified Data.Text as T
139import qualified Data.Text.Encoding as TE
140import Control.Monad.Trans.Reader
141import Control.Monad.Trans.State.Strict
143-- | Exception thrown if a 'Query' could not be formatted correctly.
144-- This may occur if the number of \'@?@\' characters in the query
145-- string does not match the number of parameters provided.
146data FormatError = FormatError {
147 fmtMessage :: String
148 , fmtQuery :: Query
149 , fmtParams :: [ByteString]
150 } deriving (Eq, Show, Typeable)
152instance Exception FormatError
154-- | Format a query string.
155--
156-- This function is exposed to help with debugging and logging. Do not
157-- use it to prepare queries for execution.
158--
159-- String parameters are escaped according to the character set in use
160-- on the 'Connection'.
161--
162-- Throws 'FormatError' if the query string could not be formatted
163-- correctly.
164formatQuery :: ToRow q => Connection -> Query -> q -> IO ByteString
165formatQuery conn q@(Query template) qs
166 | null xs && '?' `B.notElem` template = return template
167 | otherwise = toByteString <$> buildQuery conn q template xs
168 where xs = toRow qs
170-- | Format a query string with a variable number of rows.
171--
172-- This function is exposed to help with debugging and logging. Do not
173-- use it to prepare queries for execution.
174--
175-- The query string must contain exactly one substitution group,
176-- identified by the SQL keyword \"@VALUES@\" (case insensitive)
177-- followed by an \"@(@\" character, a series of one or more \"@?@\"
178-- characters separated by commas, and a \"@)@\" character. White
179-- space in a substitution group is permitted.
180--
181-- Throws 'FormatError' if the query string could not be formatted
182-- correctly.
183formatMany :: (ToRow q) => Connection -> Query -> [q] -> IO ByteString
184formatMany _ q [] = fmtError "no rows supplied" q []
185formatMany conn q@(Query template) qs = do
186 case parseTemplate template of
187 Just (before, qbits, after) -> do
188 bs <- mapM (buildQuery conn q qbits . toRow) qs
189 return . toByteString . mconcat $ fromByteString before :
190 intersperse (fromChar ',') bs ++
191 [fromByteString after]
192 Nothing -> fmtError "syntax error in multi-row template" q []
194-- Split the input string into three pieces, @before@, @qbits@, and @after@,
195-- following this grammar:
196--
197-- start: ^ before qbits after $
198-- before: ([^?]* [^?\w])? 'VALUES' \s*
199-- qbits: '(' \s* '?' \s* (',' \s* '?' \s*)* ')'
200-- after: [^?]*
201--
202-- \s: [ \t\n\r\f]
203-- \w: [A-Z] | [a-z] | [\x80-\xFF] | '_' | '$' | [0-9]
204--
205-- This would be much more concise with some sort of regex engine.
206-- 'formatMany' used to use pcre-light instead of this hand-written parser,
207-- but pcre is a hassle to install on Windows.
208parseTemplate :: ByteString -> Maybe (ByteString, ByteString, ByteString)
209parseTemplate template =
210 -- Convert input string to uppercase, to facilitate searching.
211 search $ B.map toUpper_ascii template
212 where
213 -- Search for the next occurrence of "VALUES"
214 search bs =
215 case B.breakSubstring "VALUES" bs of
216 (x, y)
217 -- If "VALUES" is not present in the string, or any '?' characters
218 -- were encountered prior to it, fail.
219 | B.null y || ('?' `B.elem` x)
220 -> Nothing
222 -- If "VALUES" is preceded by an identifier character (a.k.a. \w),
223 -- try the next occurrence.
224 | not (B.null x) && isIdent (B.last x)
225 -> search $ B.drop 6 y
227 -- Otherwise, we have a legitimate "VALUES" token.
228 | otherwise
229 -> parseQueryBits $ skipSpace $ B.drop 6 y
231 -- Parse '(' \s* '?' \s* . If this doesn't match
232 -- (and we don't consume a '?'), look for another "VALUES".
233 --
234 -- qb points to the open paren (if present), meaning it points to the
235 -- beginning of the "qbits" production described above. This is why we
236 -- pass it down to finishQueryBits.
237 parseQueryBits qb
238 | Just ('(', skipSpace -> bs1) <- B.uncons qb
239 , Just ('?', skipSpace -> bs2) <- B.uncons bs1
240 = finishQueryBits qb bs2
241 | otherwise
242 = search qb
244 -- Parse (',' \s* '?' \s*)* ')' [^?]* .
245 --
246 -- Since we've already consumed at least one '?', there's no turning back.
247 -- The parse has to succeed here, or the whole thing fails
248 -- (because we don't allow '?' to appear outside of the VALUES list).
249 finishQueryBits qb bs0
250 | Just (')', bs1) <- B.uncons bs0
251 = if '?' `B.elem` bs1
252 then Nothing
253 else Just $ slice3 template qb bs1
254 | Just (',', skipSpace -> bs1) <- B.uncons bs0
255 , Just ('?', skipSpace -> bs2) <- B.uncons bs1
256 = finishQueryBits qb bs2
257 | otherwise
258 = Nothing
260 -- Slice a string into three pieces, given the start offset of the second
261 -- and third pieces. Each "offset" is actually a tail of the uppercase
262 -- version of the template string. Its length is used to infer the offset.
263 --
264 -- It is important to note that we only slice the original template.
265 -- We don't want our all-caps trick messing up the actual query string.
266 slice3 source p1 p2 =
267 (s1, s2, source'')
268 where
269 (s1, source') = B.splitAt (B.length source - B.length p1) source
270 (s2, source'') = B.splitAt (B.length p1 - B.length p2) source'
272 toUpper_ascii c | c >= 'a' && c <= 'z' = toEnum (fromEnum c - 32)
273 | otherwise = c
275 -- Based on the definition of {ident_cont} in src/backend/parser/scan.l
276 -- in the PostgreSQL source. No need to check [a-z], since we converted
277 -- the whole string to uppercase.
278 isIdent c = (c >= '0' && c <= '9')
279 || (c >= 'A' && c <= 'Z')
280 || (c >= '\x80' && c <= '\xFF')
281 || c == '_'
282 || c == '$'
284 -- Based on {space} in scan.l
285 isSpace_ascii c = (c == ' ') || (c >= '\t' && c <= '\r')
287 skipSpace = B.dropWhile isSpace_ascii
289escapeStringConn :: Connection -> ByteString -> IO (Either ByteString ByteString)
290escapeStringConn conn s =
291 withConnection conn $ \c ->
292 PQ.escapeStringConn c s >>= checkError c
294escapeByteaConn :: Connection -> ByteString -> IO (Either ByteString ByteString)
295escapeByteaConn conn s =
296 withConnection conn $ \c ->
297 PQ.escapeByteaConn c s >>= checkError c
299checkError :: PQ.Connection -> Maybe a -> IO (Either ByteString a)
300checkError _ (Just x) = return $ Right x
301checkError c Nothing = Left . maybe "" id <$> PQ.errorMessage c
303buildQuery :: Connection -> Query -> ByteString -> [Action] -> IO Builder
304buildQuery conn q template xs = zipParams (split template) <$> mapM sub xs
305 where quote = either (\msg -> fmtError (utf8ToString msg) q xs)
306 (inQuotes . fromByteString)
307 utf8ToString = T.unpack . TE.decodeUtf8
308 sub (Plain b) = pure b
309 sub (Escape s) = quote <$> escapeStringConn conn s
310 sub (EscapeByteA s) = quote <$> escapeByteaConn conn s
311 sub (Many ys) = mconcat <$> mapM sub ys
312 split s = fromByteString h : if B.null t then [] else split (B.tail t)
313 where (h,t) = B.break (=='?') s
314 zipParams (t:ts) (p:ps) = t <> p <> zipParams ts ps
315 zipParams [t] [] = t
316 zipParams _ _ = fmtError (show (B.count '?' template) ++
317 " '?' characters, but " ++
318 show (length xs) ++ " parameters") q xs
320-- | Execute an @INSERT@, @UPDATE@, or other SQL query that is not
321-- expected to return results.
322--
323-- Returns the number of rows affected.
324--
325-- Throws 'FormatError' if the query could not be formatted correctly.
326execute :: (ToRow q) => Connection -> Query -> q -> IO Int64
327execute conn template qs = do
328 result <- exec conn =<< formatQuery conn template qs
329 finishExecute conn template result
331-- | Execute a multi-row @INSERT@, @UPDATE@, or other SQL query that is not
332-- expected to return results.
333--
334-- Returns the number of rows affected.
335--
336-- Throws 'FormatError' if the query could not be formatted correctly.
337executeMany :: (ToRow q) => Connection -> Query -> [q] -> IO Int64
338executeMany _ _ [] = return 0
339executeMany conn q qs = do
340 result <- exec conn =<< formatMany conn q qs
341 finishExecute conn q result
343-- | Execute @INSERT ... RETURNING@, @UPDATE ... RETURNING@, or other SQL
344-- query that accepts multi-row input and is expected to return results.
345-- Note that it is possible to write
346-- @'query' conn "INSERT ... RETURNING ..." ...@
347-- in cases where you are only inserting a single row, and do not need
348-- functionality analogous to 'executeMany'.
349--
350-- Throws 'FormatError' if the query could not be formatted correctly.
351returning :: (ToRow q, FromRow r) => Connection -> Query -> [q] -> IO [r]
352returning _ _ [] = return []
353returning conn q qs = do
354 result <- exec conn =<< formatMany conn q qs
355 finishQuery conn q result
357-- | Perform a @SELECT@ or other SQL query that is expected to return
358-- results. All results are retrieved and converted before this
359-- function returns.
360--
361-- When processing large results, this function will consume a lot of
362-- client-side memory. Consider using 'fold' instead.
363--
364-- Exceptions that may be thrown:
365--
366-- * 'FormatError': the query string could not be formatted correctly.
367--
368-- * 'QueryError': the result contains no columns (i.e. you should be
369-- using 'execute' instead of 'query').
370--
371-- * 'ResultError': result conversion failed.
372query :: (ToRow q, FromRow r) => Connection -> Query -> q -> IO [r]
373query = queryWith fromRow
375-- | A version of 'query' that does not perform query substitution.
376query_ :: (FromRow r) => Connection -> Query -> IO [r]
377query_ = queryWith_ fromRow
379-- | A version of 'query' taking parser as argument
380queryWith :: ToRow q => RowParser r -> Connection -> Query -> q -> IO [r]
381queryWith parser conn template qs = do
382 result <- exec conn =<< formatQuery conn template qs
383 finishQueryWith parser conn template result
385-- | A version of 'query_' taking parser as argument
386queryWith_ :: RowParser r -> Connection -> Query -> IO [r]
387queryWith_ parser conn q@(Query que) = do
388 result <- exec conn que
389 finishQueryWith parser conn q result
391-- | Perform a @SELECT@ or other SQL query that is expected to return
392-- results. Results are streamed incrementally from the server, and
393-- consumed via a left fold.
394--
395-- When dealing with small results, it may be simpler (and perhaps
396-- faster) to use 'query' instead.
397--
398-- This fold is /not/ strict. The stream consumer is responsible for
399-- forcing the evaluation of its result to avoid space leaks.
400--
401-- Exceptions that may be thrown:
402--
403-- * 'FormatError': the query string could not be formatted correctly.
404--
405-- * 'QueryError': the result contains no columns (i.e. you should be
406-- using 'execute' instead of 'query').
407--
408-- * 'ResultError': result conversion failed.
410fold :: ( FromRow row, ToRow params )
411 => Connection
412 -> Query
413 -> params
414 -> a
415 -> (a -> row -> IO a)
416 -> IO a
417fold = foldWithOptions defaultFoldOptions
419data FetchQuantity
420 = Automatic
421 | Fixed !Int
423data FoldOptions
424 = FoldOptions {
425 fetchQuantity :: !FetchQuantity,
426 transactionMode :: !TransactionMode
427 }
429defaultFoldOptions :: FoldOptions
430defaultFoldOptions = FoldOptions {
431 fetchQuantity = Automatic,
432 transactionMode = TransactionMode ReadCommitted ReadOnly
433 }
435foldWithOptions :: ( FromRow row, ToRow params )
436 => FoldOptions
437 -> Connection
438 -> Query
439 -> params
440 -> a
441 -> (a -> row -> IO a)
442 -> IO a
443foldWithOptions opts conn template qs a f = do
444 q <- formatQuery conn template qs
445 doFold opts conn template (Query q) a f
447-- | A version of 'fold' that does not perform query substitution.
448fold_ :: (FromRow r) =>
449 Connection
450 -> Query -- ^ Query.
451 -> a -- ^ Initial state for result consumer.
452 -> (a -> r -> IO a) -- ^ Result consumer.
453 -> IO a
454fold_ = foldWithOptions_ defaultFoldOptions
457foldWithOptions_ :: (FromRow r) =>
458 FoldOptions
459 -> Connection
460 -> Query -- ^ Query.
461 -> a -- ^ Initial state for result consumer.
462 -> (a -> r -> IO a) -- ^ Result consumer.
463 -> IO a
464foldWithOptions_ opts conn query a f = doFold opts conn query query a f
467doFold :: ( FromRow row )
468 => FoldOptions
469 -> Connection
470 -> Query
471 -> Query
472 -> a
473 -> (a -> row -> IO a)
474 -> IO a
475doFold FoldOptions{..} conn _template q a0 f = do
476 stat <- withConnection conn PQ.transactionStatus
477 case stat of
478 PQ.TransIdle -> withTransactionMode transactionMode conn go
479 PQ.TransInTrans -> go
480 PQ.TransActive -> fail "foldWithOpts FIXME: PQ.TransActive"
481 -- This _shouldn't_ occur in the current incarnation of
482 -- the library, as we aren't using libpq asynchronously.
483 -- However, it could occur in future incarnations of
484 -- this library or if client code uses the Internal module
485 -- to use raw libpq commands on postgresql-simple connections.
486 PQ.TransInError -> fail "foldWithOpts FIXME: PQ.TransInError"
487 -- This should be turned into a better error message.
488 -- It is probably a bad idea to automatically roll
489 -- back the transaction and start another.
490 PQ.TransUnknown -> fail "foldWithOpts FIXME: PQ.TransUnknown"
491 -- Not sure what this means.
492 where
493 declare = do
494 name <- newTempName conn
495 _ <- execute_ conn $ mconcat
496 [ "DECLARE ", name, " NO SCROLL CURSOR FOR ", q ]
497 return name
498 fetch (Query name) = query_ conn $
499 Query (toByteString (fromByteString "FETCH FORWARD "
500 <> integral chunkSize
501 <> fromByteString " FROM "
502 <> fromByteString name
503 ))
504 close name =
505 (execute_ conn ("CLOSE " <> name) >> return ()) `E.catch` \ex ->
506 -- Don't throw exception if CLOSE failed because the transaction is
507 -- aborted. Otherwise, it will throw away the original error.
508 if isFailedTransactionError ex then return () else throwIO ex
510 go = bracket declare close $ \name ->
511 let loop a = do
512 rs <- fetch name
513 if null rs then return a else foldM f a rs >>= loop
514 in loop a0
516-- FIXME: choose the Automatic chunkSize more intelligently
517-- One possibility is to use the type of the results, although this
518-- still isn't a perfect solution, given that common types (e.g. text)
519-- are of highly variable size.
520-- A refinement of this technique is to pick this number adaptively
521-- as results are read in from the database.
522 chunkSize = case fetchQuantity of
523 Automatic -> 256
524 Fixed n -> n
526-- | A version of 'fold' that does not transform a state value.
527forEach :: (ToRow q, FromRow r) =>
528 Connection
529 -> Query -- ^ Query template.
530 -> q -- ^ Query parameters.
531 -> (r -> IO ()) -- ^ Result consumer.
532 -> IO ()
533forEach conn template qs = fold conn template qs () . const
534{-# INLINE forEach #-}
536-- | A version of 'forEach' that does not perform query substitution.
537forEach_ :: (FromRow r) =>
538 Connection
539 -> Query -- ^ Query template.
540 -> (r -> IO ()) -- ^ Result consumer.
541 -> IO ()
542forEach_ conn template = fold_ conn template () . const
543{-# INLINE forEach_ #-}
545forM' :: (Ord n, Num n) => n -> n -> (n -> IO a) -> IO [a]
546forM' lo hi m = loop hi []
547 where
548 loop !n !as
549 | n < lo = return as
550 | otherwise = do
551 a <- m n
552 loop (n-1) (a:as)
554finishQuery :: FromRow r => Connection -> Query -> PQ.Result -> IO [r]
555finishQuery = finishQueryWith fromRow
557finishQueryWith :: RowParser r -> Connection -> Query -> PQ.Result -> IO [r]
558finishQueryWith parser conn q result = do
559 status <- PQ.resultStatus result
560 case status of
561 PQ.EmptyQuery ->
562 throwIO $ QueryError "query: Empty query" q
563 PQ.CommandOk -> do
564 throwIO $ QueryError "query resulted in a command response" q
565 PQ.TuplesOk -> do
566 let unCol (PQ.Col x) = fromIntegral x :: Int
567 nrows <- PQ.ntuples result
568 ncols <- PQ.nfields result
569 forM' 0 (nrows-1) $ \row -> do
570 let rw = Row row result
571 okvc <- runConversion (runStateT (runReaderT (unRP parser) rw) 0) conn
572 case okvc of
573 Ok (val,col) | col == ncols -> return val
574 | otherwise -> do
575 vals <- forM' 0 (ncols-1) $ \c -> do
576 tinfo <- getTypeInfo conn =<< PQ.ftype result c
577 v <- PQ.getvalue result row c
578 return ( tinfo
579 , fmap ellipsis v )
580 throw (ConversionFailed
581 (show (unCol ncols) ++ " values: " ++ show vals)
582 Nothing
583 ""
584 (show (unCol col) ++ " slots in target type")
585 "mismatch between number of columns to \
586 \convert and number in target type")
587 Errors [] -> throwIO $ ConversionFailed "" Nothing "" "" "unknown error"
588 Errors [x] -> throwIO x
589 Errors xs -> throwIO $ ManyErrors xs
590 PQ.CopyOut ->
591 throwIO $ QueryError "query: COPY TO is not supported" q
592 PQ.CopyIn ->
593 throwIO $ QueryError "query: COPY FROM is not supported" q
594 PQ.BadResponse -> throwResultError "query" result status
595 PQ.NonfatalError -> throwResultError "query" result status
596 PQ.FatalError -> throwResultError "query" result status
598ellipsis :: ByteString -> ByteString
599ellipsis bs
600 | B.length bs > 15 = B.take 10 bs `B.append` "[...]"
601 | otherwise = bs
603fmtError :: String -> Query -> [Action] -> a
604fmtError msg q xs = throw FormatError {
605 fmtMessage = msg
606 , fmtQuery = q
607 , fmtParams = map twiddle xs
608 }
609 where twiddle (Plain b) = toByteString b
610 twiddle (Escape s) = s
611 twiddle (EscapeByteA s) = s
612 twiddle (Many ys) = B.concat (map twiddle ys)
614-- $use
615--
616-- SQL-based applications are somewhat notorious for their
617-- susceptibility to attacks through the injection of maliciously
618-- crafted data. The primary reason for widespread vulnerability to
619-- SQL injections is that many applications are sloppy in handling
620-- user data when constructing SQL queries.
621--
622-- This library provides a 'Query' type and a parameter substitution
623-- facility to address both ease of use and security.
625-- $querytype
626--
627-- A 'Query' is a @newtype@-wrapped 'ByteString'. It intentionally
628-- exposes a tiny API that is not compatible with the 'ByteString'
629-- API; this makes it difficult to construct queries from fragments of
630-- strings. The 'query' and 'execute' functions require queries to be
631-- of type 'Query'.
632--
633-- To most easily construct a query, enable GHC's @OverloadedStrings@
634-- language extension and write your query as a normal literal string.
635--
636-- > {-# LANGUAGE OverloadedStrings #-}
637-- >
638-- > import Database.PostgreSQL.Simple
639-- >
640-- > hello = do
641-- > conn <- connect defaultConnectInfo
642-- > query_ conn "select 2 + 2"
643--
644-- A 'Query' value does not represent the actual query that will be
645-- executed, but is a template for constructing the final query.
647-- $subst
648--
649-- Since applications need to be able to construct queries with
650-- parameters that change, this library provides a query substitution
651-- capability.
652--
653-- The 'Query' template accepted by 'query' and 'execute' can contain
654-- any number of \"@?@\" characters. Both 'query' and 'execute'
655-- accept a third argument, typically a tuple. When constructing the
656-- real query to execute, these functions replace the first \"@?@\" in
657-- the template with the first element of the tuple, the second
658-- \"@?@\" with the second element, and so on. If necessary, each
659-- tuple element will be quoted and escaped prior to substitution;
660-- this defeats the single most common injection vector for malicious
661-- data.
662--
663-- For example, given the following 'Query' template:
664--
665-- > select * from user where first_name = ? and age > ?
666--
667-- And a tuple of this form:
668--
669-- > ("Boris" :: String, 37 :: Int)
670--
671-- The query to be executed will look like this after substitution:
672--
673-- > select * from user where first_name = 'Boris' and age > 37
674--
675-- If there is a mismatch between the number of \"@?@\" characters in
676-- your template and the number of elements in your tuple, a
677-- 'FormatError' will be thrown.
678--
679-- Note that the substitution functions do not attempt to parse or
680-- validate your query. It's up to you to write syntactically valid
681-- SQL, and to ensure that each \"@?@\" in your query template is
682-- matched with the right tuple element.
684-- $inference
685--
686-- Automated type inference means that you will often be able to avoid
687-- supplying explicit type signatures for the elements of a tuple.
688-- However, sometimes the compiler will not be able to infer your
689-- types. Consider a case where you write a numeric literal in a
690-- parameter tuple:
691--
692-- > query conn "select ? + ?" (40,2)
693--
694-- The above query will be rejected by the compiler, because it does
695-- not know the specific numeric types of the literals @40@ and @2@.
696-- This is easily fixed:
697--
698-- > query conn "select ? + ?" (40 :: Double, 2 :: Double)
699--
700-- The same kind of problem can arise with string literals if you have
701-- the @OverloadedStrings@ language extension enabled. Again, just
702-- use an explicit type signature if this happens.
704-- $only_param
705--
706-- Haskell lacks a single-element tuple type, so if you have just one
707-- value you want substituted into a query, what should you do?
708--
709-- The obvious approach would appear to be something like this:
710--
711-- > instance (ToField a) => ToRow a where
712-- > ...
713--
714-- Unfortunately, this wreaks havoc with type inference, so we take a
715-- different tack. To represent a single value @val@ as a parameter, write
716-- a singleton list @[val]@, use 'Just' @val@, or use 'Only' @val@.
717--
718-- Here's an example using a singleton list:
719--
720-- > execute conn "insert into users (first_name) values (?)"
721-- > ["Nuala"]
723-- $in
724--
725-- Suppose you want to write a query using an @IN@ clause:
726--
727-- > select * from users where first_name in ('Anna', 'Boris', 'Carla')
728--
729-- In such cases, it's common for both the elements and length of the
730-- list after the @IN@ keyword to vary from query to query.
731--
732-- To address this case, use the 'In' type wrapper, and use a single
733-- \"@?@\" character to represent the list. Omit the parentheses
734-- around the list; these will be added for you.
735--
736-- Here's an example:
737--
738-- > query conn "select * from users where first_name in ?" $
739-- > In ["Anna", "Boris", "Carla"]
740--
741-- If your 'In'-wrapped list is empty, the string @\"(null)\"@ will be
742-- substituted instead, to ensure that your clause remains
743-- syntactically valid.
745-- $many
746--
747-- If you know that you have many rows of data to insert into a table,
748-- it is much more efficient to perform all the insertions in a single
749-- multi-row @INSERT@ statement than individually.
750--
751-- The 'executeMany' function is intended specifically for helping
752-- with multi-row @INSERT@ and @UPDATE@ statements. Its rules for
753-- query substitution are different than those for 'execute'.
754--
755-- What 'executeMany' searches for in your 'Query' template is a
756-- single substring of the form:
757--
758-- > values (?,?,?)
759--
760-- The rules are as follows:
761--
762-- * The keyword @VALUES@ is matched case insensitively.
763--
764-- * There must be no other \"@?@\" characters anywhere in your
765-- template.
766--
767-- * There must be one or more \"@?@\" in the parentheses.
768--
769-- * Extra white space is fine.
770--
771-- The last argument to 'executeMany' is a list of parameter
772-- tuples. These will be substituted into the query where the @(?,?)@
773-- string appears, in a form suitable for use in a multi-row @INSERT@
774-- or @UPDATE@.
775--
776-- Here is an example:
777--
778-- > executeMany conn
779-- > "insert into users (first_name,last_name) values (?,?)"
780-- > [("Boris","Karloff"),("Ed","Wood")]
781--
782-- The query that will be executed here will look like this
783-- (reformatted for tidiness):
784--
785-- > insert into users (first_name,last_name) values
786-- > ('Boris','Karloff'),('Ed','Wood')
788-- $returning
789--
790-- PostgreSQL supports returning values from data manipulation statements
791-- such as @INSERT@ and @UPDATE@. You can use these statements by
792-- using 'query' instead of 'execute'. For multi-tuple inserts,
793-- use 'returning' instead of 'executeMany'.
794--
795-- For example, were there an auto-incrementing @id@ column and
796-- timestamp column @t@ that defaulted to the present time for the
797-- @sales@ table, then the following query would insert two new
798-- sales records and also return their new @id@s and timestamps.
799--
800-- > let q = "insert into sales (amount, label) values (?,?) returning id, t"
801-- > xs :: [(Int, UTCTime)] <- query conn q (15,"Sawdust")
802-- > ys :: [(Int, UTCTime)] <- returning conn q [(20,"Chips"),(300,"Wood")]
804-- $result
805--
806-- The 'query' and 'query_' functions return a list of values in the
807-- 'FromRow' typeclass. This class performs automatic extraction
808-- and type conversion of rows from a query result.
809--
810-- Here is a simple example of how to extract results:
811--
812-- > import qualified Data.Text as Text
813-- >
814-- > xs <- query_ conn "select name,age from users"
815-- > forM_ xs $ \(name,age) ->
816-- > putStrLn $ Text.unpack name ++ " is " ++ show (age :: Int)
817--
818-- Notice two important details about this code:
819--
820-- * The number of columns we ask for in the query template must
821-- exactly match the number of elements we specify in a row of the
822-- result tuple. If they do not match, a 'ResultError' exception
823-- will be thrown.
824--
825-- * Sometimes, the compiler needs our help in specifying types. It
826-- can infer that @name@ must be a 'Text', due to our use of the
827-- @unpack@ function. However, we have to tell it the type of @age@,
828-- as it has no other information to determine the exact type.
830-- $null
831--
832-- The type of a result tuple will look something like this:
833--
834-- > (Text, Int, Int)
835--
836-- Although SQL can accommodate @NULL@ as a value for any of these
837-- types, Haskell cannot. If your result contains columns that may be
838-- @NULL@, be sure that you use 'Maybe' in those positions of your
839-- tuple.
840--
841-- > (Text, Maybe Int, Int)
842--
843-- If 'query' encounters a @NULL@ in a row where the corresponding
844-- Haskell type is not 'Maybe', it will throw a 'ResultError'
845-- exception.
847-- $only_result
848--
849-- To specify that a query returns a single-column result, use the
850-- 'Only' type.
851--
852-- > xs <- query_ conn "select id from users"
853-- > forM_ xs $ \(Only dbid) -> {- ... -}
855-- $types
856--
857-- Conversion of SQL values to Haskell values is somewhat
858-- permissive. Here are the rules.
859--
860-- * For numeric types, any Haskell type that can accurately represent
861-- all values of the given PostgreSQL type is considered \"compatible\".
862-- For instance, you can always extract a PostgreSQL 16-bit @SMALLINT@
863-- column to a Haskell 'Int'. The Haskell 'Float' type can accurately
864-- represent a @SMALLINT@, so it is considered compatble with those types.
865--
866-- * A numeric compatibility check is based only on the type of a
867-- column, /not/ on its values. For instance, a PostgreSQL 64-bit
868-- @BIGINT@ column will be considered incompatible with a Haskell
869-- 'Int16', even if it contains the value @1@.
870--
871-- * If a numeric incompatibility is found, 'query' will throw a
872-- 'ResultError'.
873--
874-- * The 'String' and 'Text' types are assumed to be encoded as
875-- UTF-8. If you use some other encoding, decoding may fail or give
876-- wrong results. In such cases, write a @newtype@ wrapper and a
877-- custom 'Result' instance to handle your encoding.